Micro Focus Access Manager Information Leakage Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 26, 2021 · Catalog

   Detected

   Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Nov 17, 2021 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.

Affected

• cpe microfocus/access managerversion unspecified
• vendor Micro Focus Micro Focus Access Managerversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2021-22506

  Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

  cisa.gov
• CVE.orgVulnerability recordCVE-2021-22506

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2021-22506

  30-day exploitation probability 25.7%

  first.org
• NIST NVDVulnerability recordCVE-2021-22506

  Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Release Notes · microfocus.com